CVE-2026-118577 Details
Description
A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is b0d3876247a0a64fa0e430e4b21870e41f503182. It is recommended to apply a patch to fix this issue.
A server-side request forgery (SSRF) vulnerability has been identified in maotoumao MusicFreeDesktop versions 0.0.6 through 0.0.8. The issue resides in the request-forwarder component, which lacks authentication and exposes an API that allows arbitrary websites to make requests from the victim's machine to internal services, including those only accessible via localhost. This vulnerability can be exploited to read responses from these internal services, potentially leading to unauthorized access to sensitive information or functionality.
Users are advised to update to the patched version of MusicFreeDesktop, which includes a token-based authentication mechanism for the request-forwarder, removing the server-side request forgery vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/maotoumao/MusicFreeDesktop/ | [email protected] | ProductVendor |
| https://github.com/maotoumao/MusicFreeDesktop/commit/b0d3876247a0a64fa0e430e4b21870e41f503182 | [email protected] | Source CodeVendor |
| https://github.com/maotoumao/MusicFreeDesktop/issues/443 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-118577 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1025070 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/428016 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/428016/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| maotoumao MusicFreeDesktop | 0.0.6 (semver) 0.0.7 (semver) 0.0.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |